New one... "Clean This"

[Li'l Abner]

Not really new, just a new name. In either Safe or Normal mode it boots
directly up to splash screen with "Clean This" on it with only one place ot
click. I forget what that was but I didn't click it.
This was in XP SP3. I got around it by booting inSafe Mode and picking the
Administrator account which let me in. Then I checked the registry to see
if the shell\open\command had been tampered with. It hadn't.
Then went to Documents And Settings\User\Application Data and looked for a
three lettered exe file. Sure enough, it was "gog.exe". I renamed it and
was then able to download MBAM, install and run it. It found one
Trojan.FakeAlert and one other lesser thing.
Rebooted into Safe Mode Users Account, ran MBAM again. Found nothing.
Then to Normal Mode, ran MBAM and SAS both.
Seems to be OK now. I'm running a full scan with Avira but don't expect to
find anything much.

Google "Clean This" and the first hit is "How to delete Clean This virus".
That's computing.net (Tom's Guide Tech Support).

Go get 'em Dave! :-)

--
--- Everybody has a right to my opinion. ---

[FromTheRafters]

"Li'l Abner" <blvstk@dogpatch.com> wrote in message
news:Xns9F0ADD39EC6A9butter@wefb973cbe498...
> Not really new, just a new name. In either Safe or Normal mode it boots
> directly up to splash screen with "Clean This" on it with only one place ot
> click. I forget what that was but I didn't click it.
> This was in XP SP3. I got around it by booting inSafe Mode and picking the
> Administrator account which let me in. Then I checked the registry to see
> if the shell\open\command had been tampered with. It hadn't.
> Then went to Documents And Settings\User\Application Data and looked for a
> three lettered exe file. Sure enough, it was "gog.exe". I renamed it and
> was then able to download MBAM, install and run it. It found one
> Trojan.FakeAlert and one other lesser thing.
> Rebooted into Safe Mode Users Account, ran MBAM again. Found nothing.
> Then to Normal Mode, ran MBAM and SAS both.
> Seems to be OK now. I'm running a full scan with Avira but don't expect to
> find anything much.
>
> Google "Clean This" and the first hit is "How to delete Clean This virus".
> That's computing.net (Tom's Guide Tech Support).
>
> Go get 'em Dave! :-)

It's sad that those that should know better continue to "dumb down"
and call everything a virus.

Aside from that, good recovery from that trojan outlined above.

[Max Wachtel]

On 06/20/2011 10:51 PM, FromTheRafters wrote:
> "Li'l Abner"<blvstk@dogpatch.com> wrote in message
> news:Xns9F0ADD39EC6A9butter@wefb973cbe498...
>> Not really new, just a new name. In either Safe or Normal mode it boots
>> directly up to splash screen with "Clean This" on it with only one place ot
>> click. I forget what that was but I didn't click it.
>> This was in XP SP3. I got around it by booting inSafe Mode and picking the
>> Administrator account which let me in. Then I checked the registry to see
>> if the shell\open\command had been tampered with. It hadn't.
>> Then went to Documents And Settings\User\Application Data and looked for a
>> three lettered exe file. Sure enough, it was "gog.exe". I renamed it and
>> was then able to download MBAM, install and run it. It found one
>> Trojan.FakeAlert and one other lesser thing.
>> Rebooted into Safe Mode Users Account, ran MBAM again. Found nothing.
>> Then to Normal Mode, ran MBAM and SAS both.
>> Seems to be OK now. I'm running a full scan with Avira but don't expect to
>> find anything much.
>>
>> Google "Clean This" and the first hit is "How to delete Clean This virus".
>> That's computing.net (Tom's Guide Tech Support).
>>
>> Go get 'em Dave! :-)
>
> It's sad that those that should know better continue to "dumb down"
> and call everything a virus.
>
> Aside from that, good recovery from that trojan outlined above.
>
>
those who get infected do not care what it is called-they just want it
gone. too bad they do not get a choice of what OS they get when buying a
new pc (I know what I would choose). perhaps the EU could push for that
next time they get M$ in court.

[Li'l Abner]

"FromTheRafters" <erratic.howard@gmail.com> wrote in
news:itp0v4$oqo$1@dont-email.me:

> "Li'l Abner" <blvstk@dogpatch.com> wrote in message
> news:Xns9F0ADD39EC6A9butter@wefb973cbe498...
>> Not really new, just a new name. In either Safe or Normal mode it
>> boots directly up to splash screen with "Clean This" on it with only
>> one place ot click. I forget what that was but I didn't click it.
>> This was in XP SP3. I got around it by booting inSafe Mode and
>> picking the Administrator account which let me in. Then I checked the
>> registry to see if the shell\open\command had been tampered with. It
>> hadn't. Then went to Documents And Settings\User\Application Data and
>> looked for a three lettered exe file. Sure enough, it was "gog.exe".
>> I renamed it and was then able to download MBAM, install and run it.
>> It found one Trojan.FakeAlert and one other lesser thing.
>> Rebooted into Safe Mode Users Account, ran MBAM again. Found nothing.
>> Then to Normal Mode, ran MBAM and SAS both.
>> Seems to be OK now. I'm running a full scan with Avira but don't
>> expect to find anything much.
>>
>> Google "Clean This" and the first hit is "How to delete Clean This
>> virus". That's computing.net (Tom's Guide Tech Support).
>>
>> Go get 'em Dave! :-)
>
> It's sad that those that should know better continue to "dumb down"
> and call everything a virus.
>
> Aside from that, good recovery from that trojan outlined above.

The problem is that most everybody except those of us who understand it
don't know the difference between a virus and other forms of malware.
Before people even bring their computers they tell me they have a virus. I
just don't try to explain it to them anymore. "Virus" actually sounds worse
than "malware" and that's what they want to hear. I fix it and they're
happy.

--
--- Everybody has a right to my opinion. ---

[FromTheRafters]

"Max Wachtel" <maxpro4u@hotmail.com> wrote in message
news:itp2t3$ncd$1@news.albasani.net...
> On 06/20/2011 10:51 PM, FromTheRafters wrote:
>> "Li'l Abner"<blvstk@dogpatch.com> wrote in message
>> news:Xns9F0ADD39EC6A9butter@wefb973cbe498...
>>> Not really new, just a new name. In either Safe or Normal mode it boots
>>> directly up to splash screen with "Clean This" on it with only one place ot
>>> click. I forget what that was but I didn't click it.
>>> This was in XP SP3. I got around it by booting inSafe Mode and picking the
>>> Administrator account which let me in. Then I checked the registry to see
>>> if the shell\open\command had been tampered with. It hadn't.
>>> Then went to Documents And Settings\User\Application Data and looked for a
>>> three lettered exe file. Sure enough, it was "gog.exe". I renamed it and
>>> was then able to download MBAM, install and run it. It found one
>>> Trojan.FakeAlert and one other lesser thing.
>>> Rebooted into Safe Mode Users Account, ran MBAM again. Found nothing.
>>> Then to Normal Mode, ran MBAM and SAS both.
>>> Seems to be OK now. I'm running a full scan with Avira but don't expect to
>>> find anything much.
>>>
>>> Google "Clean This" and the first hit is "How to delete Clean This virus".
>>> That's computing.net (Tom's Guide Tech Support).
>>>
>>> Go get 'em Dave! :-)
>>
>> It's sad that those that should know better continue to "dumb down"
>> and call everything a virus.
>>
>> Aside from that, good recovery from that trojan outlined above.
>>
>>
> those who get infected do not care what it is called-they just want it gone.

I realize that, but Tom's Guide Tech Support (and oh so many other
*professionals*) should endeavor to get the terms right.

Why continue to call it a virus when it is *not* a virus. Just because
the average Joe doesn't know better, is no reason to perpetuate
bad terminology. The computer virus is already defined in computer
science, and programs that don't fit the definition should not be
called viruses.

[FromTheRafters]

"Li'l Abner" <blvstk@dogpatch.com> wrote in message
news:Xns9F0AE6BC55E78butter@wefb973cbe498...
> "FromTheRafters" <erratic.howard@gmail.com> wrote in
> news:itp0v4$oqo$1@dont-email.me:
>
>> "Li'l Abner" <blvstk@dogpatch.com> wrote in message
>> news:Xns9F0ADD39EC6A9butter@wefb973cbe498...
>>> Not really new, just a new name. In either Safe or Normal mode it
>>> boots directly up to splash screen with "Clean This" on it with only
>>> one place ot click. I forget what that was but I didn't click it.
>>> This was in XP SP3. I got around it by booting inSafe Mode and
>>> picking the Administrator account which let me in. Then I checked the
>>> registry to see if the shell\open\command had been tampered with. It
>>> hadn't. Then went to Documents And Settings\User\Application Data and
>>> looked for a three lettered exe file. Sure enough, it was "gog.exe".
>>> I renamed it and was then able to download MBAM, install and run it.
>>> It found one Trojan.FakeAlert and one other lesser thing.
>>> Rebooted into Safe Mode Users Account, ran MBAM again. Found nothing.
>>> Then to Normal Mode, ran MBAM and SAS both.
>>> Seems to be OK now. I'm running a full scan with Avira but don't
>>> expect to find anything much.
>>>
>>> Google "Clean This" and the first hit is "How to delete Clean This
>>> virus". That's computing.net (Tom's Guide Tech Support).
>>>
>>> Go get 'em Dave! :-)
>>
>> It's sad that those that should know better continue to "dumb down"
>> and call everything a virus.
>>
>> Aside from that, good recovery from that trojan outlined above.
>
> The problem is that most everybody except those of us who understand it
> don't know the difference between a virus and other forms of malware.
> Before people even bring their computers they tell me they have a virus. I
> just don't try to explain it to them anymore.

That's okay, we all tire of having to explain to folks that don't care. My
main gripe here is in published text from so-called professionals. The
thing is, most of them actually know better but are dumbing down for
the masses and helping to reinforce the misconception.

[...]